app = Flask(__name__)

# 用戶數(shù)據(jù)庫模擬

users = {

"admin": {"password": "adminpass", "roles": ["admin", "user"]},

"guest": {"password": "guestpass", "roles": ["user"]}

}

@app.route('/login', methods=['POST'])

def login():

data = request.get_json()

username = data['username']

password = data['password']

if username in users and users[username]['password'] == password:

return jsonify({"status": "success", "roles": users[username]['roles']})

else:

return jsonify({"status": "failure", "message": "Invalid credentials"}), 401

@app.route('/protected', methods=['GET'])

def protected():

auth_header = request.headers.get('Authorization')

if not auth_header or 'Bearer' not in auth_header:

return jsonify({"message": "Unauthorized"}), 403

token = auth_header.split()[1]

# 假設(shè)token包含用戶角色信息

roles = token.split('.')

if 'admin' in roles:

return jsonify({"message": "Welcome, Admin!"}), 200

else:

return jsonify({"message": "Access Denied"}), 403

if __name__ == '__main__':

app.run(debug=True)